@podosoft/podokit 1.4.2 → 1.6.0

package/dist/templates/modules/admin-dashboard/files/apps/web/src/routes/account/+page.svelte

@@ -1,6 +1,5 @@
 <script lang="ts">
   import AccountPage from "#lib/components/account-page.svelte";
-  import ImpersonationBanner from "#lib/components/impersonation-banner.svelte";
   import LanguageSwitch from "#lib/components/language-switch.svelte";
   import SiteFooter from "#lib/components/site-footer.svelte";
   import ThemeToggle from "#lib/components/theme-toggle.svelte";
@@ -13,15 +12,12 @@
   let {
     data,
   }: {
-    data: { user: SessionUser; currentSessionId: string | null; capabilities: Capabilities; impersonating: boolean };
+    data: { user: SessionUser; currentSessionId: string | null; capabilities: Capabilities };
   } = $props();
   const i18n = getI18n();
 </script>
 
 <div class="flex min-h-svh flex-col">
-  {#if data.impersonating}
-    <ImpersonationBanner email={data.user.email} />
-  {/if}
   <header class="flex h-14 items-center gap-2 border-b px-4">
     <Button href="/" variant="ghost">{i18n.t.nav.home}</Button>
     <div class="flex-1"></div>

package/dist/templates/modules/admin-dashboard/files/dot-claude/skills/podokit-data-table/SKILL.md

@@ -38,6 +38,8 @@ put pagination outside the table.
 - Responsive columns: set `hideBelow` to `sm`, `md`, `lg`, or `xl`, then apply
   `cellClass(columnKey)` to the matching `Table.Cell`. Never repeat the
   responsive class by hand; the shared class keeps headers and cells aligned.
+- Header controls such as a select-all checkbox: pass a `head` snippet on the
+  column; it replaces the label and sort button. Give the control an aria-label.
 - Give each table an `ariaLabel` and scope Playwright locators to that table.
 - No footer needed: `perPage={0}`.
 - **Search & filters**: put the shared `table-toolbar.svelte` (`TableToolbar`)

package/dist/templates/modules/admin-dashboard/files/tests/api/account-sessions.api.spec.ts

@@ -0,0 +1,55 @@
+import { signInOnSeparateDevices } from "../helpers/devices";
+import { expect, test } from "../helpers/disposable-users";
+
+const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
+const origin = { origin: base };
+
+type Page = {
+  current: { id: string } | null;
+  items: Array<{ id: string }>;
+  nextCursor: string | null;
+  total: number;
+};
+
+test("account sessions page the user's own sessions and revoke one by id", async ({ playwright, disposableUsers }) => {
+  const email = `api-account-sessions-${Date.now()}@example.com`;
+  const password = "Podokit3e-Str0ng!pw";
+  await disposableUsers.create({ email, password, name: "Account sessions" });
+  expect(await signInOnSeparateDevices(email, password, 4)).toEqual([200, 200, 200, 200]);
+  const ctx = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await ctx.post("/api/auth/sign-in/email", { data: { email, password } })).ok()).toBeTruthy();
+  const current = (await (await ctx.get("/api/auth/get-session")).json()) as { session: { id: string } };
+
+  const first = await ctx.get("/api/account/sessions?limit=2");
+  expect(first.ok()).toBeTruthy();
+  const firstText = await first.text();
+  expect(firstText).not.toContain("token");
+  const page1 = JSON.parse(firstText) as Page;
+  expect(page1.current?.id).toBe(current.session.id);
+  expect(page1.total).toBe(5);
+  expect(page1.items).toHaveLength(2);
+  expect(page1.nextCursor).toBeTruthy();
+  const page2 = (await (await ctx.get(`/api/account/sessions?limit=2&cursor=${encodeURIComponent(page1.nextCursor ?? "")}`)).json()) as Page;
+  expect(page2.current?.id).toBe(current.session.id);
+  expect(page2.nextCursor).toBeNull();
+  const ids = [...page1.items, ...page2.items].map((item) => item.id);
+  expect(new Set(ids).size).toBe(4);
+  expect(ids).not.toContain(current.session.id);
+
+  // Another user's session cannot be revoked through this endpoint.
+  const otherEmail = `api-account-sessions-other-${Date.now()}@example.com`;
+  await disposableUsers.create({ email: otherEmail, password, name: "Other user" });
+  const otherUser = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  expect((await otherUser.post("/api/auth/sign-in/email", { data: { email: otherEmail, password } })).ok()).toBeTruthy();
+  const otherSession = (await (await otherUser.get("/api/auth/get-session")).json()) as { session: { id: string } };
+  const foreign = await ctx.delete(`/api/account/sessions/${encodeURIComponent(otherSession.session.id)}`);
+  expect(foreign.status()).toBe(404);
+  expect(await foreign.json()).toMatchObject({ error: { code: "ACCOUNT_SESSION_NOT_FOUND" } });
+  expect((await otherUser.get("/api/auth/get-session")).ok()).toBeTruthy();
+  await otherUser.dispose();
+
+  const revoked = await ctx.delete(`/api/account/sessions/${encodeURIComponent(ids[0] ?? "")}`);
+  expect(revoked.status()).toBe(204);
+  expect(((await (await ctx.get("/api/account/sessions?limit=2")).json()) as Page).total).toBe(4);
+  await ctx.dispose();
+});

package/dist/templates/modules/admin-dashboard/files/tests/api/audit.api.spec.ts

@@ -128,7 +128,7 @@ test("the audit log rejects bad paging parameters", async ({ playwright }) => {
 
 // Audit logging is a DB-backed on/off toggle (auth_config `server`, applied live).
 // Runs after the recording tests and restores the flag so nothing else is affected.
-test("audit logging honours the DB on/off toggle @smoke", async ({ playwright, disposableUsers }) => {
+test("audit logging honours the DB on/off toggle @smoke", { tag: "@exclusive" }, async ({ playwright, disposableUsers }) => {
   const admin = await signedIn(playwright, ADMIN);
   test.skip((await admin.get("/api/audit-logs")).status() === 404, "audit-log module not installed");
   const auditLog = async () => (await (await admin.get("/api/account/capabilities")).json()).auditLog as boolean;

package/dist/templates/modules/admin-dashboard/files/tests/api/auth-config.api.spec.ts

@@ -4,7 +4,6 @@ import {
   isUserCreationAllowed,
 } from "../../apps/api/src/auth/feature-gate";
 import { ADMIN } from "../helpers/accounts";
-import { exclusive } from "../helpers/exclusive";
 
 const base = process.env.E2E_BASE_URL ?? "http://localhost:5001";
 const origin = { origin: base };
@@ -17,69 +16,65 @@ async function adminCtx(playwright: import("@playwright/test").PlaywrightWorkerA
   return ctx;
 }
 
-test("admin can enable Google OAuth from the DB and it applies without a restart", async ({ playwright }) => {
+test("admin can enable Google OAuth from the DB and it applies without a restart", { tag: "@exclusive" }, async ({ playwright }) => {
   test.slow();
-  await exclusive("social-providers", async () => {
-    const admin = await adminCtx(playwright);
-    await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
-    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
-
-    // Before: provider not configured.
-    await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
-
-    // Paste credentials via the admin API.
-    const put = await admin.put("/api/account/auth-config", {
-      data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
-    });
-    expect(put.ok()).toBeTruthy();
-    const view = await put.json();
-    expect(view.social.google.enabled).toBe(true);
-    expect(view.social.google.hasSecret).toBe(true);
-    expect(view.social.google.clientId).toBe("dummy-google-client-id");
-    expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
-
-    // Applied live (no restart): social sign-in now redirects to Google.
-    await expect
-      .poll(async () => {
-        const r = await social();
-        return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
-      }, { timeout: 8000 })
-      .toContain("accounts.google.com");
-    const caps = await (await anon.get("/api/account/capabilities")).json();
-    expect(caps.providers).toContain("google");
-
-    await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
-    await anon.dispose();
-    await admin.dispose();
+  const admin = await adminCtx(playwright);
+  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // clean start
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const social = () => anon.post("/api/auth/sign-in/social", { data: { provider: "google", callbackURL: `${base}/admin` } });
+
+  // Before: provider not configured.
+  await expect.poll(async () => (await social()).status(), { timeout: 8000 }).toBe(404);
+
+  // Paste credentials via the admin API.
+  const put = await admin.put("/api/account/auth-config", {
+    data: { social: { google: { enabled: true, clientId: "dummy-google-client-id", clientSecret: "dummy-google-client-secret" } } },
   });
+  expect(put.ok()).toBeTruthy();
+  const view = await put.json();
+  expect(view.social.google.enabled).toBe(true);
+  expect(view.social.google.hasSecret).toBe(true);
+  expect(view.social.google.clientId).toBe("dummy-google-client-id");
+  expect("clientSecret" in view.social.google).toBe(false); // secret is never returned
+
+  // Applied live (no restart): social sign-in now redirects to Google.
+  await expect
+    .poll(async () => {
+      const r = await social();
+      return r.ok() ? (((await r.json())?.url as string) ?? "") : "";
+    }, { timeout: 8000 })
+    .toContain("accounts.google.com");
+  const caps = await (await anon.get("/api/account/capabilities")).json();
+  expect(caps.providers).toContain("google");
+
+  await admin.put("/api/account/auth-config", { data: { social: { google: { enabled: false } } } }); // restore
+  await anon.dispose();
+  await admin.dispose();
 });
 
-test("admin can add and remove a social provider dynamically", async ({ playwright }) => {
+test("admin can add and remove a social provider dynamically", { tag: "@exclusive" }, async ({ playwright }) => {
   test.slow();
-  await exclusive("social-providers", async () => {
-    const admin = await adminCtx(playwright);
-    // The catalog offers providers beyond the two legacy env-backed ones.
-    const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
-    expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
-
-    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
-
-    // Add GitHub (a provider with no env fallback) → applies live, no restart.
-    await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
-    await expect
-      .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
-      .toContain("github.com");
-
-    // Remove it → the row is deleted and the provider stops working (again live).
-    await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
-    expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
-    await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
+  const admin = await adminCtx(playwright);
+  // The catalog offers providers beyond the two legacy env-backed ones.
+  const catalog = (await (await admin.get("/api/account/auth-config")).json()).catalog as Array<{ id: string }>;
+  expect(catalog.map((c) => c.id)).toEqual(expect.arrayContaining(["google", "github", "apple"]));
 
-    await anon.dispose();
-    await admin.dispose();
-  });
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const github = () => anon.post("/api/auth/sign-in/social", { data: { provider: "github", callbackURL: `${base}/admin` } });
+
+  // Add GitHub (a provider with no env fallback) → applies live, no restart.
+  await admin.put("/api/account/auth-config", { data: { social: { github: { enabled: true, clientId: "dummy-github-client-id", clientSecret: "dummy-github-client-secret" } } } });
+  await expect
+    .poll(async () => { const r = await github(); return r.ok() ? (((await r.json())?.url as string) ?? "") : ""; }, { timeout: 8000 })
+    .toContain("github.com");
+
+  // Remove it → the row is deleted and the provider stops working (again live).
+  await admin.put("/api/account/auth-config", { data: { social: { github: { delete: true } } } });
+  expect("github" in (await (await admin.get("/api/account/auth-config")).json()).social).toBe(false);
+  await expect.poll(async () => (await github()).status(), { timeout: 8000 }).toBe(404);
+
+  await anon.dispose();
+  await admin.dispose();
 });
 
 test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwright }) => {
@@ -91,50 +86,47 @@ test("auth-config is admin-only and never leaks secrets @smoke", async ({ playwr
   await user.dispose();
 });
 
-test("automatic logout validates and applies a sliding session lifetime", async ({ playwright }) => {
-  test.slow();
-  await exclusive("session-idle-timeout", async () => {
-    const admin = await adminCtx(playwright);
-    const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-
-    try {
-      expect(
-        (await admin.put("/api/account/auth-config", {
-          data: { server: { sessionIdleTimeoutMinutes: 4 } },
-        })).status(),
-      ).toBe(400);
-
-      const enabled = await admin.put("/api/account/auth-config", {
-        data: { server: { sessionIdleTimeoutMinutes: 30 } },
-      });
-      expect(enabled.ok()).toBeTruthy();
-      expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
-
-      const caps = await (await admin.get("/api/account/capabilities")).json();
-      expect(caps.sessionIdleTimeoutMinutes).toBe(30);
-
-      const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
-        data: { email: ADMIN.email, password: ADMIN.password },
-      });
-      expect(signIn.ok()).toBeTruthy();
-      expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
-
-      const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
-        expiresAt: string;
-      }>;
-      const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
-      expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
-    } finally {
-      await admin.put("/api/account/auth-config", {
-        data: { server: { sessionIdleTimeoutMinutes: null } },
-      });
-      await freshAdmin.dispose();
-      await admin.dispose();
-    }
-  });
+test("automatic logout validates and applies a sliding session lifetime", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const freshAdmin = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: { server: { sessionIdleTimeoutMinutes: 4 } },
+      })).status(),
+    ).toBe(400);
+
+    const enabled = await admin.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: 30 } },
+    });
+    expect(enabled.ok()).toBeTruthy();
+    expect((await enabled.json()).server.sessionIdleTimeoutMinutes).toBe(30);
+
+    const caps = await (await admin.get("/api/account/capabilities")).json();
+    expect(caps.sessionIdleTimeoutMinutes).toBe(30);
+
+    const signIn = await freshAdmin.post("/api/auth/sign-in/email", {
+      data: { email: ADMIN.email, password: ADMIN.password },
+    });
+    expect(signIn.ok()).toBeTruthy();
+    expect(signIn.headers()["set-cookie"]).toMatch(/Max-Age=1800(?:;|,)/i);
+
+    const sessions = (await (await admin.get("/api/auth/list-sessions")).json()) as Array<{
+      expiresAt: string;
+    }>;
+    const latestExpiry = Math.max(...sessions.map((session) => new Date(session.expiresAt).getTime()));
+    expect(latestExpiry).toBeLessThanOrEqual(Date.now() + 30 * 60_000 + 10_000);
+  } finally {
+    await admin.put("/api/account/auth-config", {
+      data: { server: { sessionIdleTimeoutMinutes: null } },
+    });
+    await freshAdmin.dispose();
+    await admin.dispose();
+  }
 });
 
-test("new registrations require approval when the policy is enabled", async ({ playwright }) => {
+test("new registrations require approval when the policy is enabled", { tag: "@exclusive" }, async ({ playwright }) => {
   const admin = await adminCtx(playwright);
   const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
   const password = "Podokit3e-Str0ng!pw";
@@ -213,79 +205,76 @@ test("new registrations require approval when the policy is enabled", async ({ p
   }
 });
 
-test("closed public sign-up blocks new OAuth users but preserves existing sign-in", async ({ playwright }) => {
-  test.slow();
-  await exclusive(["site-general", "social-providers"], async () => {
-    const admin = await adminCtx(playwright);
-    const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
-    const password = "Podokit3e-Str0ng!pw";
-    const adminCreatedEmail = `closed-admin-${Date.now()}@example.com`;
-    const initialSite = (await (await anon.get("/api/site/settings")).json()) as {
-      allowSignup?: string | null;
-    };
-    const initialAllowSignup = initialSite.allowSignup === "false" ? "false" : "true";
-    let adminCreatedId = "";
-
-    try {
-      expect(
-        (await admin.put("/api/account/auth-config", {
-          data: {
-            social: {
-              google: {
-                enabled: true,
-                clientId: "dummy-google-client-id",
-                clientSecret: "dummy-google-client-secret",
-              },
+test("closed public sign-up blocks new OAuth users but preserves existing sign-in", { tag: "@exclusive" }, async ({ playwright }) => {
+  const admin = await adminCtx(playwright);
+  const anon = await playwright.request.newContext({ baseURL: base, extraHTTPHeaders: origin });
+  const password = "Podokit3e-Str0ng!pw";
+  const adminCreatedEmail = `closed-admin-${Date.now()}@example.com`;
+  const initialSite = (await (await anon.get("/api/site/settings")).json()) as {
+    allowSignup?: string | null;
+  };
+  const initialAllowSignup = initialSite.allowSignup === "false" ? "false" : "true";
+  let adminCreatedId = "";
+
+  try {
+    expect(
+      (await admin.put("/api/account/auth-config", {
+        data: {
+          social: {
+            google: {
+              enabled: true,
+              clientId: "dummy-google-client-id",
+              clientSecret: "dummy-google-client-secret",
             },
           },
-        })).ok(),
-      ).toBeTruthy();
-      expect((await admin.put("/api/site/settings", { data: { allowSignup: "false" } })).ok()).toBeTruthy();
+        },
+      })).ok(),
+    ).toBeTruthy();
+    expect((await admin.put("/api/site/settings", { data: { allowSignup: "false" } })).ok()).toBeTruthy();
 
-      // The site policy uses a short cache shared by sign-up requests and user
-      // creation hooks, so wait for the setting to become live.
-      await new Promise((resolve) => setTimeout(resolve, 3_200));
+    // The site policy uses a short cache shared by sign-up requests and user
+    // creation hooks, so wait for the setting to become live.
+    await new Promise((resolve) => setTimeout(resolve, 3_200));
 
-      const signup = await anon.post("/api/auth/sign-up/email", {
-        data: {
-          email: `closed-${Date.now()}@example.com`,
-          password,
-          name: "Closed Registration",
-        },
-      });
-      expect(signup.status()).toBe(403);
-      expect((await signup.json()).code).toBe(PUBLIC_SIGNUP_DISABLED);
-
-      // OAuth initiation must stay available for existing social users. Only a
-      // callback that attempts to create a new user is rejected by the DB hook.
-      const social = await anon.post("/api/auth/sign-in/social", {
-        data: { provider: "google", callbackURL: `${base}/` },
-      });
-      expect(social.ok()).toBeTruthy();
-      expect(((await social.json()).url as string)).toContain("accounts.google.com");
-      expect(isUserCreationAllowed(false, "/callback/google")).toBe(false);
-      expect(isUserCreationAllowed(false, undefined)).toBe(false);
-
-      // Deliberate administrator provisioning remains available while the public
-      // site is closed.
-      expect(isUserCreationAllowed(false, "/admin/create-user")).toBe(true);
-      const adminCreated = await admin.post("/api/auth/admin/create-user", {
-        data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
-      });
-      expect(adminCreated.ok()).toBeTruthy();
-      adminCreatedId = ((await adminCreated.json()).user as { id: string }).id;
-    } finally {
-      if (adminCreatedId) {
-        await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
-      }
-      await admin.put("/api/site/settings", { data: { allowSignup: initialAllowSignup } });
-      await admin.put("/api/account/auth-config", {
-        data: { social: { google: { enabled: false } } },
-      });
-      await new Promise((resolve) => setTimeout(resolve, 3_200));
-      await anon.get("/api/auth/get-session");
-      await anon.dispose();
-      await admin.dispose();
+    const signup = await anon.post("/api/auth/sign-up/email", {
+      data: {
+        email: `closed-${Date.now()}@example.com`,
+        password,
+        name: "Closed Registration",
+      },
+    });
+    expect(signup.status()).toBe(403);
+    expect((await signup.json()).code).toBe(PUBLIC_SIGNUP_DISABLED);
+
+    // OAuth initiation must stay available for existing social users. Only a
+    // callback that attempts to create a new user is rejected by the DB hook.
+    const social = await anon.post("/api/auth/sign-in/social", {
+      data: { provider: "google", callbackURL: `${base}/` },
+    });
+    expect(social.ok()).toBeTruthy();
+    expect(((await social.json()).url as string)).toContain("accounts.google.com");
+    expect(isUserCreationAllowed(false, "/callback/google")).toBe(false);
+    expect(isUserCreationAllowed(false, undefined)).toBe(false);
+
+    // Deliberate administrator provisioning remains available while the public
+    // site is closed.
+    expect(isUserCreationAllowed(false, "/admin/create-user")).toBe(true);
+    const adminCreated = await admin.post("/api/auth/admin/create-user", {
+      data: { email: adminCreatedEmail, password, name: "Admin Created", role: "user" },
+    });
+    expect(adminCreated.ok()).toBeTruthy();
+    adminCreatedId = ((await adminCreated.json()).user as { id: string }).id;
+  } finally {
+    if (adminCreatedId) {
+      await admin.post("/api/auth/admin/remove-user", { data: { userId: adminCreatedId } });
     }
-  });
+    await admin.put("/api/site/settings", { data: { allowSignup: initialAllowSignup } });
+    await admin.put("/api/account/auth-config", {
+      data: { social: { google: { enabled: false } } },
+    });
+    await new Promise((resolve) => setTimeout(resolve, 3_200));
+    await anon.get("/api/auth/get-session");
+    await anon.dispose();
+    await admin.dispose();
+  }
 });